Detections
Analytics
WN11-AU-000585 - Windows 11 must have command line process auditing events enabled for failures.
Information
When this policy setting is enabled, the operating system generates audit events when a process fails to start and the name of the program or user that created it.These audit events can assist in understanding how a computer is being used and tracking user activity.
Solution
Go to Computer Configuration >> Windows Settings >>Security Settings>> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> Set 'Audit Process Creation' to 'Failure'.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R7_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows 11 STIG v2r7
Category: ACCESS CONTROL
References: 800-53|AC-6(9), CAT|II, CCI|CCI-002234, Rule-ID|SV-257770r958412_rule, STIG-ID|WN11-AU-000585, Vuln-ID|V-257770
Plugin: Windows
Control ID: 4106b845419b5ab4a9d1a4ca27991d596ec067a8a038853c30cd2f44a94682ec